PECB ISO 18788 Lead Implementer key terms

A documented management framework that directs how an organization plans, delivers, monitors, and improves the security services it provides to clients under its control, following ISO 18788 requirements.

The set of activities and services an organization performs to protect people, property, information, and client interests, delivered under contractual and legal obligations and managed as a coherent set of processes.

The organization or person that commissions security services and to whom the security provider owes contractual, legal, and ethical duties, including the protection of their assets and the people in their care.

Any person or organization that can affect, be affected by, or perceive itself to be affected by the security provider's decisions or activities, such as clients, staff, communities, regulators, and shareholders.

The combination of internal and external issues, legal obligations, stakeholder expectations, and operating conditions that shape how the security provider designs and runs its management system.

The documented boundaries of the management system, defining which locations, services, contracts, and organizational units are covered by the security operations management system and therefore subject to certification audit.

A controlled document listing the ISO 18788 requirements and Annex A controls the organization has adopted, with justification for inclusion or exclusion and a reference to how each is implemented.

A structured process of identifying threats and vulnerabilities relevant to security operations, analyzing their likelihood and impact, and evaluating which risks need treatment against defined criteria.

A document that records the selected options for modifying risks, the controls to be applied, the resources and owners responsible, and the timelines and expected outcomes of implementation.

An ongoing process to identify, prevent, mitigate, and account for how the security provider's activities affect the human rights of clients, staff, and affected communities, including the right to life, liberty, and security.

The application of physical or coercive measures by security personnel, which must be lawful, necessary, proportionate, and subject to clear rules, training, reporting, and oversight within the management system.

A formal channel through which employees, clients, communities, or other affected parties can raise complaints about security operations and receive a timely, fair, and documented response without fear of retaliation.

The active involvement of top management in establishing policy, providing resources, integrating the SOMS into business processes, and being accountable for its effectiveness rather than delegating it entirely.

A top-level statement of the provider's intentions and direction on security operations, including commitments to legal compliance, human rights respect, client requirements, and continual improvement.

Measurable, time-bound results the organization intends to achieve for its security operations, set at relevant functions and levels and consistent with the security policy and client obligations.

The demonstrated ability of personnel to apply knowledge and skills required for their security duties, verified through education, training, experience, licensing, and periodic re-evaluation.

Planned activities that ensure staff understand the security policy, their role in the management system, the risks of their work, and the human rights and legal limits on their conduct.

The processes used to plan, implement, and control security operations, including documented procedures, resource allocation, contractual requirements, and control of outsourced or subcontracted activities.

The structured process for reporting, recording, investigating, responding to, and learning from security incidents, including escalation, client notification, and corrective action where needed.

Arrangements where another party performs security activities on the provider's behalf, requiring the provider to define controls, verify competence and conduct, and retain accountability for the work performed.

Information that must be controlled and maintained by the organization, including policies, procedures, records, and evidence of results, with rules for creation, approval, version control, and retention.

The systematic collection and analysis of data on whether security operations and the management system achieve planned results, using defined indicators, methods, frequency, and responsibilities.

An independent, planned examination of the SOMS against the organization's own criteria and ISO 18788 requirements, used to identify nonconformities and provide input to management review.

A top-management evaluation, held at planned intervals, of the SOMS's suitability, adequacy, and effectiveness, covering performance, audit results, risks, and decisions on improvement actions.

A failure to meet a requirement of ISO 18788, the organization's own procedures, or applicable legal and contractual obligations, which must be recorded, evaluated, and addressed.

Action taken to eliminate the cause of a detected nonconformity or incident so that it does not recur, including root cause analysis, implementation, and verification of effectiveness.

The recurring process of enhancing the SOMS's performance by identifying opportunities, acting on them, and evaluating results, supported by data from monitoring, audits, and reviews.

An independent third-party assessment, typically in two stages, that verifies the SOMS conforms to ISO 18788 and is effectively implemented before a certificate is issued.

Records, statements, observations, and other verifiable information that an auditor uses to determine whether audit criteria are met, including interviews, site observation, and documented records.

The initial certification audit phase that reviews documentation, scope, readiness, and internal audit and management review evidence to confirm the organization is prepared for the Stage 2 assessment.

The certification audit phase that evaluates implementation and effectiveness on site, sampling operational evidence, interviewing personnel, and testing conformity with ISO 18788 requirements.

An audit conclusion recorded as a nonconformity, observation, or opportunity for improvement, classified by severity and requiring a written response and closure evidence from the organization.

A periodic post-certification audit, usually annual, that confirms the certified SOMS continues to conform and remain effective, covering selected requirements, sites, and changes since the last audit.

A full reassessment conducted before the certificate expires, typically every three years, to confirm the SOMS still meets all requirements and remains suitable for continued certification.

Laws, regulations, licenses, collective agreements, client contracts, and voluntary commitments that the security provider must identify, comply with, and keep current in the management system.

The specific duties arising from legal and contractual requirements that the organization must meet, monitor, and periodically evaluate for adherence and relevance to its security operations.